Kyle Noland's questions

I have a client that uses a SonicWALL NSA 2400 as their firewall. I need to setup a second LAN subnet for a handful of PC. Management has decided that there should be a second subnet even though intend to allow access across the two subnets - I know...

I'm having trouble getting communication across the 2 subnets. I can ping each gateway, but I cannot ping or seem to route traffic fron subnet A to subnet B.

Here is my current setup:

• X0 Interface: LAN zone with IP addres 192.168.1.1
• X1 Interface: WAN zone with WAN IP address
• X2 Interface: LAN zone with IP address 192.168.75.1

I have configured ARP and routes for the secondar subnet (X2) according to this SonicWALL KB article: http://www.sonicwall.com/downloads/supporting_multiple_firewalled_subnets_on_sonicos_enhanced.pdf using "Example 1".

At this point I don't minding if I have to throw the SonicWALL GVC software VPN client into the mix to make it work. It feel like I have an Access Rule issue, but for testing I made LAN > LAN, WAN > LAN and VPN > LAN rules wide open with the same results.

I have a client that has an IBM xSeries 345 eServer. Per the IBM support website, I have downloaded the ServerGuide Setup 7.4.17 installation ISO and burned a bootable CD. The CD boots fine and loads the utility. I walk through the following screens without any issue:

1. Set the date and Time
2. Detect the IBM ServeRAID card and install the latest firmware
3. Clear the hard disks
4. Set up the RAID array

The next step is format the NOS partition. I select my partition size and the utility goes through the following steps:

1. Creating NOS partition
2. Formatting NOS partition (NTFS)
3. Copying W32 files

The copying W32 files takes about 10 minutes. I see the CD drive and disks working hard. When the copying is complete, I'm taken to a blank page just NOS Partitioning at the top. At the bottom of the screen are the familiar Back and Exit buttons. I see the place where the Next button should be, and if I click on it I can tell there is something there, but the space is empty. No button is displayed and clicking the empty spot doesn't ever take me to the next screen.

I can't load the OS until I get past this part. I have already tried:

1. Burning multiple copies and versions of the ServerGuide CD
2. Letting the final screen just sit there over the weekend thinking it might advance after syncing the drives or something

Has anybody else seen this? I'm really at a loss here.

EDIT: I found another person who has the exact same problem as me: http://www.ibm.com/developerworks/forums/thread.jspa?messageID=14451763

I have SQL Server 2008 Express installed. Several months ago I created a full text catalog and index. I would like to index some additional table columns now, but I can't remember the name of the existing catalog. How do I find out the name of an existing full text catalog.

Hopefully this doesn't involve installing any new tools, because this is a production server.

I have a Dell PowerEdge 2850 running Windows Server 2003. It is the primary file server for one of my clients. I have another server also running Windows Server 2003 that acts as the core media server for Symantec Backup Exec 12.

I recently upgraded from Backup Exec 11d to 12. This upgrade was necessary because we also just upgraded from Exchange 2003 to Exchange 2007. After the upgrade I had to push-install the new version 12 Backup Exec Remote Agents to each of the servers I am backing up (about 6 total). 5 of my servers are doing just fine, faithfully completing backups every night. My file server routinely crashes.

Observations:

• When the server crashes, it does not blue screen, it just locks up completely. Even the mouse is unresponsive. If you leave the server locked up long enough, it will eventually reboot itself and hang on the Windows splash screen.
• There is absolutely zero useful Event Viewer evidence of a problem. The logs go from routine logging to an Unexplained Shutdown Event the next morning when I have to hard reset the server to get it to boot.
• 90% of the time the server does not boot cleanly, it hangs on the Windows splash screen. I don't have any light to shed here. When the server hangs all I can do is hard reset it and try again. Even after a successful boot and chkdsk /r operation, if you reboot the machine, you have a 90% chance it won't back up again cleanly.

The back story:

This server started crashing during nightly backups about a month ago. I tried everything I could think of to troubleshoot the problem and eventually had to give up because I could not keep coming to the office at 4 AM to try to get the server back online. One Friday I got lucky and the server stayed up for its entire full backup. I took this opportunity to restore the full backup to a temporary server I set up and switched all my users to the temporary. Then I reloaded the ailing file server.

I kept all my users on the temporary file server for about 3 weeks. I installed the same Backup Exec Remote Agent and Trend Micro A/V client on the temporary server that I was using on the regular file server. During this time, I had absolutely no problems backing up the temporary server.

I tested the reloaded file server extensively. I rebooted the server once an hour every day for 3 weeks trying to make it fail. It never did. I felt confident that the reload was the answer to my problems. I moved all of the data from the temporary server back to the regular server. I got 3 nightly backups out of it before it locked up again and started the familiar failure to boot cleanly behavior.

This weekend I decided to monitor the file server through the entire backup job. I RDPd into the file server and also into the server running Backup Exec. On the file server I opened the Task Manager so I could view the processes and watch CPU and memory usage. Everything was running smoothly for about 60GB worth of backup. Then I noticed that the byte count of the backup job in Backup Exec had stopped progressing. I looked back over at my RDP session into the file server, and I was getting real time updates about CPU and memory usage still - both nearly 0%, which is unusual. Backups usually hover around 40% usage for the duration of the backup job.

Let me reiterate this point: The screen was refreshing and I was getting real time Task Manager updates - until I clicked on the Start menu. The screen went black and the server locked up. In truth, I think the server had already locked up, the video card just hadn't figured it out yet.

I went back into my bag of trick: driving to the office and hard reseting the server over and over again when it hangs up at the Windows splash screen. I did this for 2 hours without getting a successful boot. I started panicking because I did not have a decent backup to use to get everything back onto the working temporary file server.

Once I exhausted everything I knew to do, I took a deep breath, booted to the Windows Server 2003 CD and performed a repair installation of Windows. The server came back up fine, with all of my data intact. I can now reboot the server at will and it will come back up cleanly. The problem is that I'm afraid as soon as I try to back that data up again I will back at square one.

So let me sum things up:

Here is what I've done so far to troubleshoot this server:

1. Deleted and recreated the RAID 5 sets. Initialized the drives. Reloaded the server with a fresh Server 2003 install.
2. Confirmed with Dell that I have installed the latest, Dell approved BIOS and NIC drivers.
3. Uninstalled / reinstalled the Backup Exec Remote Agent.
4. Uninstalled the Trend Micro A/V client.
5. Configured the server not to reboot itself after a blue screen so I can see any stop error. I used to think the server was blue screening, but since I enabled this setting I now know that the server just completely locks up.
6. Run chkdsk /r from the Windows Recovery Console. Several errors were found and corrected, but did not help my problem.

Help confirm or deny the following assumptions:

7. There are two problems at work here. Why the server is locking up in the first place, and why the server won't boot cleanly after a lockup.
8. This is ultimately a software problem. The server works fine and can be rebooted cleanly all day long - until the first lockup - following a fresh OS load or even a Repair installation.
9. This is not a problem with Backup Exec in general. All of my other servers back up just fine. For the record, all of the other servers run Server 2003, and some of them house more data than the file server in question here.

Any help is appreciated. The irony is almost too much to bear. Backing up my data is what is jeopardizing it.

I have a SharePoint site set up on one of my networks to service Active Directory users. To be clear, this is a Windows SharePoint Services 3.0 installation running on Windows Server 2003 Standard. It is not an option to upgrade the server or SharePoint version.

Management would like to create several new sites, one for each of a handful of clients. These sites will be used like "dropboxes" or FTP sites so that my company can make large files available to outside contacts, and vice versa.

Here are my requirements:

1. I do not want to have to create Active Directory accounts for each external contact.
2. If possible, I would like to store the external usernames and passwords in a database that I can write a small GUI for so that management can handle adding their own external contacts.
3. Each client site must be sandboxed from each other and from my main company SharePoint site.
4. I would like to keep everything running on port 80 and be able to access the sites as either clientname.mycompany.com or www.mycompany.com/clientname

If anybody has ever done this I would really appreciate hearing about any lessons you learned and suggestions for how to set this up.

Kyle

I have implemented a new Exchange 2007 server running on Server 2008 in our domain. We previously used Exchange 2003 running on Server 2003 and I had locked the Default SMTP Connector down so that it would only accept message from a range of IP addresses provided by MX Logic. For those who don't know, MX Logic provides spam filtering services, like Postini.

I have added the MX Logic IP addresses to the IP Allow List under Server Configuration > Hub Transport. My question is, how do I tell the Exchange server to deny messages from all other IP addresses that are not explicitly defined in the IP Allow List?

If it matters, this server is the Client Access Server and Hub Transport server. We do not have an Edge Transport server in the organization.

I need help generating a CSR for a Subject Alternative Name (SAN) SSL certificate to protect a new Exchange 2007 server. My main requirements are that Outlook Anywhere and OWA must work without any errors or warnings. It would be nice if the Outlook Anywhere Autodiscover service worked for Outlook 2007 clients as well.

I know there are many examples of the proper syntax for generating the CSR, but most examples assume that your Windows domain is named the same as your web domain. Here is what I think are the relevant pieces of information:

• Internal Windows domain name: internalDomain.local
• External web domain: externalDomain.com
• Exchange Server computer name: Ex2k7
• I would like to use 2048 bit SSL, unless there is a reason to use 1024
• Exchange 2007 is running on a Server 2008 box

My remote clients will connect to my new Exchange server at mail.externalDomain.com.

My certificate was purchased from GoDaddy, and it works for OWA, but Outlook Anywhere is broken. If somebody could help me with the correct syntax for generating a CSR for my situation I would like to rekey my certificate.

I'm looking for direction on some general settings to configure for a Terminal Services server group policy. It is running Server 2003 Standard and hosts about 20 people simultaneously.

Obviously you can get very granular and restrictive, but I'm looking for a good, generic baseline to start out with that balances security with usability. I will tweak as necessary.

My general requirements are:

• Users cannot install new software, drivers or updates of any kind.
• User data (Word, Excel, PDF, etc.) should be stored on network drives rather than the local file system.
• Users should not be able to modify server settings, reboot the server, shut it down, modify power options, etc.

I know we all struggle to strike a balance between keeping our user's workstations locked down but still usable. I have a real problem with one client whose users are constantly installing toolbars, games, malware etc. I really want to be able to take away their local administrative rights (and so does management). The problem is they rely on a handful of poorly written applications that require local administrator rights to run properly. Before anybody suggests it, it is not possible to get rid of these applications.

I realize I can create custom shortcuts to these applications using the runas command and saving the local administrator credentials. The problem with this solution is:

• I have to manually supply the local administrator credentials for each user.
• Some of the programs rely on data in the local user profile and do not function properly if "tricked" into thinking they are running under the ComputerName\Administrator profile.

What I would love is to install some application or apply a Group Policy that allows me to specify applications that should be allowed to elevate the local profile's permissions. Is there a solution like this available?

How does everyone else handle locking down workstations and still supporting legacy/poorly written software?

Here is my situation:

I have inherited a Windows 2003 domain with only 1 domain controller, we'll call it DC1. DC1 is also the DNS, DHCP and Exchange server for this organization. DC1 was originally a Small Business Server but was upgraded to Server 2003 Standard at some point.

There used to be a second domain controller and DNS server called DC2, but it crashed and was never removed cleanly from the domain. I have used ntdsutil to remove DC2 metadata and have deleted the computer account in Active Directory, but Name Server (NS) and Start of Authority (SOA) references to DC2 are scattered all over my DNS Forward Lookup Zone.

I have a brand new Exchange 2007 server on the way to replace what is currently DC1 (Exchange 2003, DNS, DHCP, DC). I therefore need to complete the following tasks:

1. Promote a new server on the domain to be a domain controller.
2. Transfer the FSMO roles from DC1 to the new domain controller.
3. Install DNS and DHCP on the new domain controller.
4. Remove the DNS and DHCP roles from DC1 and remove it from the domain.
5. After my new Exchange 2007 server is in place, reload DC1 and turn it into a secondary domain controller and DNS server.

I am worried that in step 3 of my plan, I will end up replicating bad DNS records to my new domain controller. What is the best way to clean up my existing DNS before replicating it to my new server? It seems like it would be best just to have a clean Forward Lookup Zone, but I don't really understand how that zone works.

I already have DNS scavenging turned on, but it never seems to clean up any of the references to DC2, the domain controller and DNS server that failed some time ago. Can I just delete the entire Forward Lookup Zone? Does it recreate itself?

Can somebody explain to me what the different containers (_msdcs,domain.local,zone.domain.local) in the Forward Lookup Zone are?